The correct option is Cryptographic hashing utilities.

Cryptographic hashing utilities are used to compute a fixed length digest from a file or disk image so that investigators can compare values taken at different times to confirm that the data has not changed. The hash value is reproducible for identical data and is therefore the standard method to demonstrate integrity during forensic handling and in court.

In practice an investigator will compute and record a hash when evidence is seized and then recompute the hash after imaging or analysis to show the values match. Common algorithms used include SHA variants and MD5 for legacy comparisons and forensic tools will record the hash alongside metadata to provide a chain of custody and integrity checks.

Google Cloud Audit Logs are logs of actions and events in Google Cloud and they are useful for tracking activity in cloud environments but they do not produce cryptographic digests of seized files or drives to prove that the evidence itself remained unchanged.

Write blocker devices are important because they prevent writing to a drive during acquisition and they reduce the chance of altering evidence. They do not by themselves prove that data has not changed. Investigators still use hashing utilities to create a verifiable integrity value for the original media and for the acquired image.

Drive cloning utilities make exact copies or images of storage media and they are used during acquisition to preserve the original device. Creating a clone does not by itself confirm integrity across time. A hash of the original and a hash of the clone are compared to demonstrate that the clone is identical to the source.

Full AWS Practitioner Certification Question